N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62239

CVE-2025-62239: Liferay Portal is vulnerable to XSS through its workflow process builder

Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HTML via the crafted input in a workflow definition.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62239

CVE-2025-62239:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.liferay:com.liferay.portal.workflow.kaleo.designer.web	maven	>= 5.0.56, < 5.0.124	5.0.124

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a cross-site scripting (XSS) issue in the workflow process builder of Liferay Portal. The root cause is the improper handling of user-supplied content in workflow definitions. The analysis of the provided patch (commit 3acad2d8683688ce022abf2dfbab9fb500c5a619) reveals two key areas where the vulnerability existed:

File Upload Handling: In SourceBuilder.js, the SourceBuilder component, which is responsible for building the workflow definition, had a file upload feature. The content of the uploaded file was read and directly set into the editor without any sanitization. The vulnerable line currentEditor.setData(event.target.result) was replaced with code that sanitizes the input by removing alert() calls. This indicates that any malicious JavaScript in the uploaded file would have been rendered, leading to XSS.
XML Validation: In xmlUtil.js, the XMLUtil.validate function was used to validate the workflow definition's XML content. The original implementation only checked if the XML was well-formed. It did not check for malicious attributes that could lead to XSS, such as onerror, innerHTML, src, or url. The patch added explicit checks for these malicious patterns. This lack of validation allowed an attacker to craft a workflow definition with embedded scripts that would be executed by the browser.

Therefore, an authenticated attacker could exploit this vulnerability by creating a workflow definition containing malicious JavaScript. When this definition is viewed or edited by another user, the script would execute in their browser, leading to a persistent XSS attack.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.